Personal data processing notification to Roskomnadzor (preparation)

Preparation date: Preparation date. This is a working sheet for an initial notification, not an official form or confirmation of entry in the register. Controller: Controller’s full entity name / full personal name​; short name: Short name (if any)​. Taxpayer identification number (ИНН): Controller’s taxpayer identification number (ИНН)​. Primary state registration number for a legal entity / individual entrepreneur (ОГРН / ОГРНИП): Primary state registration number for a legal entity / individual entrepreneur (ОГРН / ОГРНИП)​. Address: Controller’s address​. The notification shall be filed before processing begins, except for the exemptions in part 2 of Article 22 of Federal Law No. 152-FZ (ФЗ). The actual processing start date must not be replaced with a future date to conceal late filing.

Purpose: First processing purpose​. Data categories: Data for the first purpose​. Data subject categories: Categories of data subjects for the first purpose​. Legal grounds: Grounds for the first purpose​. List of actions: Actions involving data for the first purpose​. The method for the first purpose is mixed processing (automated and non-automated). Processing specifics, network use and transmission through communication channels: Processing methods for the first purpose​.

Description of measures actually implemented: Measures under Articles 18.1 and 19; compliance with protection requirements​.

Check appointment of a responsible person (for a legal entity), policy and internal documents, access restrictions, employee training, internal control, harm assessment, technical protection, activity logging, backups and incident response. Include only measures actually implemented, taking the processing method into account. A general statement that “all measures have been taken” does not replace a description. No cryptographic tools are used. This information must be checked against the actual infrastructure. Person responsible for organizing processing: Responsible person: full name / entity name​. Responsible person’s contact details: Responsible person’s contact details​. Processing start date: Actual date processing began. Period or termination condition: Period or condition for terminating processing​. Locations of databases containing Russian citizens’ personal data: Database locations​.

Include the information systems used, external storage and backup databases to the applicable extent. Do not substitute an office address for a server location without checking. Localization and cross-border transfer shall be assessed separately; having a database in Russia does not in itself establish that no data are transferred abroad. No cross-border transfers are made. The processes described do not involve access to or contracted processing of data in state and municipal information systems.

Assign Person assigned preparation and filing: full name and position​ to check the information by Filing deadline before processing begins and transfer it to the form in Appendix No. 1 to Roskomnadzor Order No. 180 dated 28.10.2022. Prepare and sign the electronic notification through Roskomnadzor’s official service using its prescribed method; retain confirmation of dispatch/receipt. Notify changes to information no later than the 15th day of the month following the month of the changes; notify termination of processing within ten working days of termination (part 7 of Article 22 of Federal Law No. 152-FZ).

The preparer shall reconcile the sheet with the actual processing register, processor agreements, system settings and internal documents. For each purpose, check that the basis, data items, data subject categories, operations and methods are specific, and exclude information unrelated to the controller’s activities. Check the current name and address, registration details, the responsible person’s full name or entity name and all necessary contact details — telephone number, postal address and email. The signatory shall substantiate authority; cryptographic tool information shall be confirmed with the technical person responsible, rather than inferred solely from the existence of a website. Notification does not replace a lawful processing basis, consent, localization or protection measures. The separate cross-border transfer notification shall be checked independently; filing the initial notification does not replace that procedure.

Retain the signed version and submission confirmation, then check the register information and any requests for clarification. Submission shall not be described as completed registration until this has been verified. Changes to previously filed information and termination of processing shall use the corresponding forms, rather than a repeat initial notification. Preparatory information checked by: Signatory’s position​ ______________ / Authorized signatory’s full name​ /. Basis of authority: Basis of authority​.